1. Field of the Invention
The present invention relates to a system and method for protecting reusable software components. In particular the present invention encrypts software components in a reusable software component library to protect against unauthorized modification and to assure authenticity of software components when the software components are decrypted by a reuser.
2. Description of the Prior Art
The ability to produce ever larger software systems while improving theft quality and reducing theft development time crucially depends upon a capability to "reuse" previously developed software components in new systems. There is an emerging electronic marketplace that will enable potential reusers to browse libraries of software components, select suitable ones, and obtain them for reuse. Rudiments of such a marketplace already exist in operational software reuse libraries. Such libraries, though, are vulnerable to the unauthorized modification of existing code or to unscrupulous parties who might misrepresent the origin of code which they place into the library.
A reuse library must provide protection against the unauthorized modification of software components in order for the software reuse marketplace to emerge. Without such protection publishers would be reluctant to place their software in a reuse library and reusers would be reluctant to use software components from the reuse library. Without such protection software components are subject to modification for purposes of malice, sabotage, espionage or others. Modifications by an innocent third party can also cause problems due to incompetence, carelessness, a lack of discipline or misunderstanding. The ability of a third party to modify a software component without detection cannot be tolerated in the reuse marketplace.
The authentication problem arises where an unscrupulous party seeks to pass off (or palm off) their software components as that of another publisher thereby preying on the reputation and goodwill of other publishers. This is of particular importance in the reuse marketplace because reusers can often only rely on the reputations and software development processes used by software publishers.
Many agencies today are actively involved in developing and evolving their software development processes. Independent organizations such as the Software Engineering Institute (SEI) evaluate these processes and rate them according to an established set of criteria. Reusers can rely on these evaluations in making their reuse selections.
There are also legal considerations to be considered such as who is representing that they created the software. Under current copyright law the innocent infringer loses against the true owner of the copyrighted work. The reuser needs some assurance that publisher has the right to permit the reuser to make use of the software component. Without such assurances the reuser risks any gains by reuse in a subsequent legal battle.
There is a critical need to provide a reuser with an assurance that the identity of the producer of software component being purchased is the software producer and not some other third party. There is also a critical need to provide the reuser with an assurance that a software component has not been corrupted or modified.